On Wed, 22 Sep 2021 13:38:51 +0300
Leon Romanovsky <leon@xxxxxxxxxx> wrote:
> From: Yishai Hadas <yishaih@xxxxxxxxxx>
>
> Add an API in the core layer to check migration state transition validity
> as part of a migration flow.
>
> The valid transitions follow the expected usage as described in
> uapi/vfio.h and triggered by QEMU.
>
> This ensures that all migration implementations follow a consistent
> migration state machine.
>
> Signed-off-by: Yishai Hadas <yishaih@xxxxxxxxxx>
> Reviewed-by: Kirti Wankhede <kwankhede@xxxxxxxxxx>
> Signed-off-by: Jason Gunthorpe <jgg@xxxxxxxxxx>
> Signed-off-by: Leon Romanovsky <leonro@xxxxxxxxxx>
> ---
> drivers/vfio/vfio.c | 41 +++++++++++++++++++++++++++++++++++++++++
> include/linux/vfio.h | 1 +
> 2 files changed, 42 insertions(+)
>
> diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
> index 3c034fe14ccb..c3ca33e513c8 100644
> --- a/drivers/vfio/vfio.c
> +++ b/drivers/vfio/vfio.c
> @@ -1664,6 +1664,47 @@ static int vfio_device_fops_release(struct inode *inode, struct file *filep)
> return 0;
> }
>
> +/**
> + * vfio_change_migration_state_allowed - Checks whether a migration state
> + * transition is valid.
> + * @new_state: The new state to move to.
> + * @old_state: The old state.
> + * Return: true if the transition is valid.
> + */
> +bool vfio_change_migration_state_allowed(u32 new_state, u32 old_state)
> +{
> + enum { MAX_STATE = VFIO_DEVICE_STATE_RESUMING };
> + static const u8 vfio_from_state_table[MAX_STATE + 1][MAX_STATE + 1] = {
> + [VFIO_DEVICE_STATE_STOP] = {
> + [VFIO_DEVICE_STATE_RUNNING] = 1,
> + [VFIO_DEVICE_STATE_RESUMING] = 1,
> + },
Our state transition diagram is pretty weak on reachable transitions
out of the _STOP state, why do we select only these two as valid?
Consistent behavior to userspace is of course nice, but I wonder if we
were expecting a device reset to get us back to _RUNNING, or if the
drivers would make use of the protocol through which a driver can nak
(write error, no state change) or fault (_ERROR device state) a state
change.
There does need to be a way to get back to _RUNNING to support a
migration failure without a reset, but would that be from _SAVING
or from _STOP and what's our rationale for the excluded states?
I'll see if I can dig through emails to find what was intended to be
reachable from _STOP. Kirti or Connie, do you recall?
Also, I think the _ERROR state is implicitly handled correctly here,
its value is >MAX_STATE so we can't transition into or out of it, but a
comment to indicate that it's been considered for this would be nice.
> + [VFIO_DEVICE_STATE_RUNNING] = {
> + [VFIO_DEVICE_STATE_STOP] = 1,
> + [VFIO_DEVICE_STATE_SAVING] = 1,
> + [VFIO_DEVICE_STATE_SAVING | VFIO_DEVICE_STATE_RUNNING] = 1,
> + },
Shameer's comment is correct here, _RESUMING is a valid next state
since the default state is _RUNNING.
> + [VFIO_DEVICE_STATE_SAVING] = {
> + [VFIO_DEVICE_STATE_STOP] = 1,
> + [VFIO_DEVICE_STATE_RUNNING] = 1,
> + },
What's the rationale that we can't return to _SAVING|_RUNNING here?
> + [VFIO_DEVICE_STATE_SAVING | VFIO_DEVICE_STATE_RUNNING] = {
> + [VFIO_DEVICE_STATE_RUNNING] = 1,
> + [VFIO_DEVICE_STATE_SAVING] = 1,
> + },
Can't we always _STOP the device at any point?
> + [VFIO_DEVICE_STATE_RESUMING] = {
> + [VFIO_DEVICE_STATE_RUNNING] = 1,
> + [VFIO_DEVICE_STATE_STOP] = 1,
> + },
Couldn't it be possible to switch immediately to _RUNNING|_SAVING for
tracing purposes? Or _SAVING, perhaps to validate the restored state
without starting the device? Thanks,
Alex
> + };
> +
> + if (new_state > MAX_STATE || old_state > MAX_STATE)
> + return false;
> +
> + return vfio_from_state_table[old_state][new_state];
> +}
> +EXPORT_SYMBOL_GPL(vfio_change_migration_state_allowed);
> +
> static long vfio_device_fops_unl_ioctl(struct file *filep,
> unsigned int cmd, unsigned long arg)
> {
> diff --git a/include/linux/vfio.h b/include/linux/vfio.h
> index b53a9557884a..e65137a708f1 100644
> --- a/include/linux/vfio.h
> +++ b/include/linux/vfio.h
> @@ -83,6 +83,7 @@ extern struct vfio_device *vfio_device_get_from_dev(struct device *dev);
> extern void vfio_device_put(struct vfio_device *device);
>
> int vfio_assign_device_set(struct vfio_device *device, void *set_id);
> +bool vfio_change_migration_state_allowed(u32 new_state, u32 old_state);
>
> /* events for the backend driver notify callback */
> enum vfio_iommu_notify_type {
